# Desktop IPC, Electron bridges and native protocols

Follow page, file and local-process inputs into privileged desktop capabilities with a realistic caller.

## Investigation sequence

1. Map process authority
2. Inventory entry points
3. Record trusted call
4. Exercise untrusted caller
5. Validate capability
6. Restore snapshot

## Used in these playbooks

[Desktop & extensions](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/desktop.html)

## Setup and invariant

Prepare a disposable desktop VM or owned Mac, a standard-user account, a clean application profile and synthetic files in a dedicated lab directory. Record release, Electron/runtime version when present, OS and installation mode. Capture the normal process tree: renderer, preload, main process, extension service worker, native host, helper or service.

**Invariant:** a lower-trust caller gets only explicitly authorized operations with constrained arguments. A local listener, broad preload API, or privileged process becomes actionable when a realistic caller can reach a sensitive capability. Console execution manually injected into a trusted renderer does not establish that route.

## Procedure and command sheet

1. **Inventory actual handlers.** In local source or extracted JavaScript, locate windows, preload APIs, IPC registrations and protocol handlers. These are read-only searches:

```bash
rg -n 'ipcMain\.(handle|on)|contextBridge|nodeIntegration|contextIsolation|sandbox' ./source
rg -n 'openExternal|setAsDefaultProtocolClient|open-url|second-instance|protocol\.handle' ./source
rg -n 'connectNative|sendNativeMessage|allowed_origins|externally_connectable' ./extension
```

For each hit record input origin, current process identity, argument schema, authorization check, and final file/shell/helper operation. Include auxiliary windows rather than assuming the main window's settings apply everywhere.

2. **Capture a valid transaction.** Open an intended file or settings panel and trace one documented bridge method. Record sender frame/origin, method, arguments, and result. Electron recommends validating IPC senders, including relevant frame identity; navigation can change which document is using a renderer. [Electron security](https://www.electronjs.org/docs/latest/tutorial/security).

3. **Change one trust condition.** Exercise the same method from an attacker-controlled page/frame reachable through an actual app feature, or from an ordinary local client for a native IPC endpoint. Compare with the trusted baseline and a disallowed method/argument. Keep the proof to reading a seeded nonsensitive file or writing one marker in the test directory. `contextIsolation` does not repair an overbroad bridge; inspect the capability exposed and the main-process checks. [Context isolation](https://www.electronjs.org/docs/latest/tutorial/context-isolation).

4. **Trace external protocols.** Invoke a discovered handler through the OS-supported route with a harmless synthetic URI. On macOS, after verifying the registered scheme:

```bash
open 'labapp://open?item=BB-DESKTOP-01'
```

Record URI parsing and argument construction before reaching native functionality. Compare a normal item with a malformed/unknown item; the latter should be rejected without launching unintended functionality. Test packaged behavior because protocol registration differs by OS and packaging. Never infer command execution merely from `shell.openExternal` being present. [Electron deep links](https://www.electronjs.org/docs/latest/tutorial/launch-app-from-url-in-another-app), [Shell API](https://www.electronjs.org/docs/latest/api/shell).

5. **Extend into native hosts.** For a browser extension, inspect native-host `allowed_origins`, executable path, message schema and downstream arguments. An allowed extension still needs to constrain untrusted page messages it forwards. A native host invocation has the user's process privileges unless another actual boundary is shown. [Chrome native messaging](https://developer.chrome.com/docs/extensions/develop/concepts/native-messaging).

## Evidence, reuse and cleanup

Preserve the complete sequence from realistic entry point to capability, with sender identity, target identity, exact input, expected denial and result. Reuse [browser trust](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/modules/browser-trust.html) for origin/navigation validation, [file boundaries](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/modules/file-boundaries.html) for path handling and [authorization matrix](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/modules/authz-matrix.html) for action ownership. Backend token effects belong to [identity/session](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/modules/identity-session.html).

- [ ] Reproduce from a reachable untrusted context, without developer-console privilege.
- [ ] Separate same-user capability abuse from administrator/system escalation.
- [ ] Compare valid sender, untrusted sender, and invalid arguments.
- [ ] Remove test protocol registrations if created, close local clients, delete marker fixtures and restore the clean profile/snapshot.

## Extension-specific continuation

For page forwarding, browser-supplied sender metadata, navigation races, worker restarts and optional permission changes, run [extension message boundaries](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/modules/extension-message-boundaries.html). Return here only when the verified path crosses into a native host, local protocol or privileged helper. Preserve the same originating page and owned synthetic marker across both procedures.


## Vulnerability reverse references

- [Electron IPC exposes main-process authority to an untrusted sender](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/vulnerabilities/electron-ipc-confused-deputy.html) — An attacker-controlled renderer or frame invokes a privileged main-process operation through insufficient sender or argument validation.
- [Desktop protocol handler misinterprets external input](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/vulnerabilities/desktop-protocol-confusion.html) — An OS-dispatched URL reaches a native command or operation with attacker-controlled arguments outside the intended handler contract.
- [Page message borrows unintended browser-extension authority](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/vulnerabilities/extension-message-authority.html) — An ordinary web page reaches a privileged extension action through insufficient message sender or argument validation.